Cognitive API policy manager

ABSTRACT

An approach is provided for securing data. A concept associated with a domain is identified as a concept of data in a first call. The identified concept is associated to policies. Based on (i) a determination that attribute names of the data in a second call match a second concept associated with the domain and (ii) a match between a pattern and field values of the data, the second concept is identified as the previously identified concept associated with the first call and an inference score is determined. Based on the inference score exceeding a threshold and the second concept being associated with the policies, the second call is blocked, thereby securing the data according to the policies, before a completion of a transaction that includes the second call, and without requiring a validation of the second concept by a human administrator.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation application claiming priority to Ser.No. 15/485,890 filed Apr. 12, 2017, the contents of which are herebyincorporated by reference.

BACKGROUND

The present invention relates to managing data at a system interfacelevel, and more particularly to policy-based management of sensitivedata.

Application programming interfaces (APIs) are driving innovation byunlocking data that used to reside in systems protected behind corporatefirewalls. The new API economy is changing the way organizations buildweb applications and mobile applications. Combined with a push towardsthe Internet of Things (IoT), the world is experiencing a rapidexpansion of API usage, where the APIs are increasingly richer andinclude both structured and unstructured data. The richness of these newAPIs is making security control harder to implement and maintain. Thedrive toward rapid innovation also creates potential security breacheswhereby sensitive data can be leaked unintentionally throughunstructured data. Traditional security models are not well-adapted todetecting these types of breaches. The traditional security models relyon declarative or static control and the responsibility falls on thedevelopers and administrators to properly define data security rules.Software delivery cycles are increasingly reduced, which leads to a riskthat new releases of APIs introduce breaches through exposition ofsensitive data, thereby transitioning the core benefit of APIs into aliability.

SUMMARY

In one embodiment, the present invention provides a method of securingdata. The method includes a computer performing a concept expansion on adata structure of the data. The method further includes the computerperforming a concept expansion on names of attributes of the data. Themethod further includes the computer matching values of fields of thedata to a pattern included in a pattern repository that includespatterns that specify respective concepts. The method further includesbased on the concept expansion of the data structure, the conceptexpansion on the names of the attributes, and the values of the fieldsof the data matched to the pattern, the computer identifying a conceptof the data and determining an inference score indicating whether theidentified concept requires a validation. The method further includes ifthe inference score exceeds a threshold score, the computer identifyinga policy associated with the identified concept and performing an actionto secure the data based on the identified policy, or if the inferencescore does not exceed the threshold score, the computer (i) receiving avalidation of the identified concept or (ii) receiving an indicationthat the identified concept is not valid and receiving a new concept ofthe data.

In another embodiment, the present invention provides a computer programproduct including a computer readable storage medium having programinstructions stored on the computer readable storage medium. The programinstructions are executed by a central processing unit (CPU) of acomputer system to cause the computer system to perform, by the CPU, aconcept expansion on a data structure of the data. Further programinstructions stored on the computer readable medium are executed by theCPU to cause the computer system to perform, by the CPU, a conceptexpansion on names of attributes of the data. Further programinstructions stored on the computer readable medium are executed by theCPU to cause the computer system to match, by the CPU, values of fieldsof the data to a pattern included in a pattern repository that includespatterns that specify respective concepts. Further program instructionsstored on the computer readable medium are executed by the CPU to causethe computer system to identify, by the CPU and based on the conceptexpansion of the data structure, the concept expansion on the names ofthe attributes, and the values of the fields of the data matched to thepattern, a concept of the data and determining an inference scoreindicating whether the identified concept requires a validation. Furtherprogram instructions stored on the computer readable medium are executedby the CPU to cause the computer system to if the inference scoreexceeds a threshold score, identify, by the CPU, a policy associatedwith the identified concept and perform, by the CPU, an action to securethe data based on the identified policy, or if the inference score doesnot exceed the threshold score, (i) receive, by the CPU, a validation ofthe identified concept or (ii) receive, by the CPU, an indication thatthe identified concept is not valid and receiving a new concept of thedata.

In another embodiment, the present invention provides a computer systemincluding a central processing unit (CPU); a memory coupled to the CPU;and a computer-readable storage device coupled to the CPU. The storagedevice includes instructions that are executed by the CPU via the memoryto implement a method of securing data. The method includes the computersystem performing a concept expansion on a data structure of the data.The method further includes the computer system performing a conceptexpansion on names of attributes of the data. The method furtherincludes the computer system matching values of fields of the data to apattern included in a pattern repository that includes patterns thatspecify respective concepts. The method further includes based on theconcept expansion of the data structure, the concept expansion on thenames of the attributes, and the values of the fields of the datamatched to the pattern, the computer system identifying a concept of thedata and determining an inference score indicating whether theidentified concept requires a validation. The method further includes ifthe inference score exceeds a threshold score, the computer systemidentifying a policy associated with the identified concept andperforming an action to secure the data based on the identified policy,or if the inference score does not exceed the threshold score, thecomputer system (i) receiving a validation of the identified concept or(ii) receiving an indication that the identified concept is not validand receiving a new concept of the data.

Embodiments of the present invention provide a security system with anunderstanding of the semantics of information being carried inunstructured data and dynamically determine what data is being leakedthrough structured or unstructured data, which avoids or decreasesundetected regulatory rule violations, user agreement breaches, andintellectual capital leaks.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a system for securing data, in accordancewith embodiments of the present invention.

FIGS. 2A-2B depict a flowchart of a process of securing data, inaccordance with embodiments of the present invention.

FIG. 3 is an example an API payload being converted to a concept map inthe process of FIG. 2, in accordance with embodiments of the presentinvention.

FIG. 4 is a block diagram of a computer included in the system of FIG. 1and that implements the process of FIGS. 2A-2B, in accordance withembodiments of the present invention.

DETAILED DESCRIPTION Overview

Embodiments of the present invention secure data at a system interfacelevel by understanding semantics of information carried in the data, anddiscovering, monitoring, and detecting breaches of data securitypolicies. Embodiments of the present invention apply cognitivecapabilities to increase the accuracy of automated interventions of thedata while significantly reducing human interventions.

In one or more embodiments of the present invention, policies areautomatically determined and applied to APIs so that sensitive data isautomatically identified and categorized based on the semantics of theAPI interface. Using a combination of cognitive computing andstatistical modeling, embodiments of the present invention inspect theAPI, including its operation name, attribute name, and value (i.e.,structured or unstructured).

Through an application of natural language recognition, conceptexpansion, and cognitive computing, embodiments disclosed herein derivea network of canonical expressions that are matched against knownpatterns. Statistical models may be used to determine the level ofcertainty of a match to a known pattern in order to request confirmationfrom a system administrator in response to a minimum threshold not beingmet. For each confirmed match, embodiments of the present inventionlearn from and track services dynamically as they evolve over time.

In one embodiment, an API Inspector translates an API payload intoinferred concepts by using cognitive computing techniques such asconcept expansion and pattern matching. A validation workflow determineswhether the inferred concepts require a validation and whether avalidation by a human is required. Subsequent to the validation, thesystem disclosed herein learns from the outcome of the validation andadjusts an inference score accordingly for subsequent inspections of APIpayloads. A policy manager validates the concept against known policysets to determine if any action is required to secure the data in thepayload. In one embodiment, a cognitive API policy manager implementsthe functionality of the aforementioned API Inspector, validationworkflow, and policy manager.

Known systems face a unique challenge to secure data because the systemsare using an inflexible declarative control which is not adaptable tothe quick development of APIs. Furthermore, known systems are not ableto understand the semantics of information being carried in the datawhich may lead to undetected violations of regulatory rules (e.g.,Payment Card Industry Data Security Standards, Export AdministrationRegulations, International Traffic in Arms regulations, etc.), breachesof user agreements, or leaks of intellectual capital. The aforementionedchallenges faced by existing security systems may be overcome by thefunctionality of the cognitive API policy manager and other embodiments,as discussed herein.

System for Securing Data

FIG. 1 is a block diagram of a system 100 for securing data, inaccordance with embodiments of the present invention. System 100includes a computer 102, which executes a software-based cognitive APIpolicy manager (CAPM) 104. System 100 also includes a software-based APIproxy 106, which is executed by another computer (not shown) which iscoupled to computer 102 via a computer network (not shown).Alternatively, API proxy 106 is executed by computer 102. System 100also includes a client computer 108 and a server computer 110 whichprovides one or more APIs (not shown).

In one embodiment, client computer 108 invokes an API in a clientrequest. API proxy 106 intercepts the client request and forwards theclient request, which includes an API payload, to CAPM 104 forinspection. Depending on the results of the validations and API payloadprocessing described below relative to the process of FIGS. 2A-2B arecompleted, CAPM 104 may generate and send a command to API proxy 106 tohandle the client request. API proxy 106 forwards the client request toserver computer 110 for processing. Server computer 110 processes theclient request and returns a reply. API proxy 106 intercepts the replyand forwards the reply, which includes an API payload, to CAPM 104 forinspection. Depending on the results of the validations and API payloadprocessing described below relative to the process of FIGS. 2A-2B, CAPM104 may generate and send a command to API proxy 106 to handle thereply. API proxy 106 sends the reply to client computer 108.

In one embodiment, CAPM 104 is implemented as a software program,operated by an administrator role, such as a security analyst. In oneembodiment, CAPM 104 is deployed in a cloud-based environment. Inanother embodiment, CAPM 104 is deployed directly within a computerserver environment.

In one embodiment, CAPM 104 attempts to match the API payload to knownconcepts to determine whether policies are being satisfied. CAPM 104 mayinspect both the request payload and the reply payload to preventinadvertent disclosure from either client computer 108 or servercomputer 110.

The functionality of the components shown in FIG. 1 is described in moredetail in the discussion of FIGS. 2A-2B and FIG. 3 presented below.

Process for Securing Data

FIGS. 2A-2B depict a flowchart of a process of securing data, inaccordance with embodiments of the present invention. The process ofFIGS. 2A-2B begins at step 200 in FIG. 2A. In step 202, CAPM 104 (seeFIG. 1) performs a concept expansion on a data structure of the databeing secured. In one embodiment, the data being secured is data in anAPI call, which may be a request sent by client computer 108 or a replysent by server computer 110. Hereinafter, in the discussion of FIGS.2A-2B, the data being secured is also referred to simply as “the data.”As used herein, a concept is defined as a class of objects and terms ina domain. The concept expansion on the data structure includesdetermining a context of the data structure by matching elements of thedata structure with respective concepts.

In step 204, CAPM 104 (see FIG. 1) performs a concept expansion on namesof attributes of the data. The concept expansion on the names of theattributes of the data includes determining a context of the names ofthe attributes by matching the names with respective concepts.

In step 206, CAPM 104 (see FIG. 1) statistically matches value(s)included in field(s) of the data to pattern(s) included in a repositoryof patterns that specify respective concepts. In one embodiment, CAPM104 (see FIG. 1) utilizes the results of steps 202, 204, and 206 toconvert the API payload into a concept map.

For example, the concept expansions in steps 202 and 204 may indicatethat the data structure of the data and the names of the attributes ofthe data match concepts related to a credit card transaction, which isrepresented by a concept map. Because the values of a field of the datain step 206 match a credit card format which is included in therepository of patterns, CAPM 104 (see FIG. 1) confirms the conceptsrelated to a credit card transaction, which were indicated by steps 202and 204.

In step 208, based on the concept expansion in steps 202 and 204 andbased on the value(s) matched to the pattern(s) in step 206, CAPM 104(see FIG. 1) identifies a concept of the data and determines aninference score which indicates whether the identified concept requiresa validation by a human administrator. In one embodiment, step 208includes CAPM 104 (see FIG. 1) inferring the concept of the data basedon a canonical model (i.e., by utilizing a pre-existing graph ofconcepts or concept map which is based on industry lexicons, to identifya match with an inference score).

In step 210, CAPM 104 (see FIG. 1) determines whether the inferencescore exceeds a predetermined threshold score. CAPM 104 (see FIG. 1)receives or determines the threshold score prior to step 210.

If CAPM 104 (see FIG. 1) determines in step 210 that the inference scoreexceeds the threshold score, then the Yes branch of step 210 is followedand step 212 is performed.

In step 212, CAPM 104 (see FIG. 1) validates the concept identified instep 208 against known policy sets.

In step 214, CAPM 104 (see FIG. 1) determines whether a policy was foundto validate the concept in step 212. If CAPM 104 (see FIG. 1) determinesin step 214 that a policy set was found to validate the concept, thenthe Yes branch of step 214 is followed and step 216 is performed.

In step 216, CAPM 104 (see FIG. 1) validates the data against the policyset by performing a known security check aligned to the policy set. Thevalidation is performed on the actual attribute values and CAPM 104 (seeFIG. 1) either (i) performs an action which affects the access to theAPI (and skips step 218) or (ii) renders a decision that determines theaction and in step 218 sends the decision to API proxy 106 (see FIG. 1)to instruct API proxy 106 (see FIG. 1) to perform the aforementionedaction. The action may include blocking the request or reply so that therequest or reply is not processed, masking sensitive data included inthe data, or removing sensitive data included in the data.

In one embodiment, step 218 is performed in cases in which theapplication of the policy is synchronous, so that CAPM 104 (see FIG. 1)returns the decision about the action to API proxy 106 (see FIG. 1) forapplication of the policy before the completion of the transaction thatincludes the API call.

Following step 218, the process of FIGS. 2A-2B ends at step 220.

Returning to step 214, if CAPM 104 (see FIG. 1) determines that a policyset was not found to validate the concept identified in step 208, thenthe No branch of step 214 is followed and the process continues withstep 222 in FIG. 2B, as discussed below.

Returning to step 210, if CAPM 104 (see FIG. 1) determines that theinference score does not exceed the threshold score, then the No branchof step 210 is followed and the process continues with step 222 in FIG.2B.

Following the No branch of step 214 and before step 222 in FIG. 2B, orfollowing the No branch of step 210 and before step 222 in FIG. 2B, ahuman administrator determines whether the concept identified in step208 is validated and CAPM 104 (see FIG. 1) receives the humanadministrator's determination about whether the concept is validated. Instep 222 in FIG. 2B, CAPM 104 (see FIG. 1) determines whether theconcept identified in step 208 (see FIG. 2A) is validated based on thedetermination of the human administrator. If CAPM 104 (see FIG. 1)determines in step 222 that the identified concept is not validatedbased on the determination of the human administrator, then the Nobranch of step 222 is followed and step 224 is performed.

In step 224, CAPM 104 (see FIG. 1) receives a new concept of the data,where the new concept is generated by the human administrator or anotherhuman, where the API call relates to the new concept. Alternatively, thehuman administrator selects another concept from a repository of knownconcepts as the concept that is appropriately related to the API call.Step 226 follows step 224.

Returning to step 222, if CAPM 104 (see FIG. 1) determines that theidentified concept is validated based on the determination of the humanadministrator, then the Yes branch of step 222 is followed and step 226is performed. In a case in which the human administrator indicates thatthe concept is validated but the inference score does not exceed thethreshold score, CAPM 104 (see FIG. 1) determines a new inference scoreby increasing the previous inference score of the concept or receivingan increased inference score, where the new inference score of theconcept exceeds the threshold score.

In step 226, if the No branch of step 222 was taken, CAPM 104 (seeFIG. 1) adds the new concept received in step 224 to the repository ofknown concepts. If the Yes branch of step 222 was taken, then in step226, CAPM 104 (see FIG. 1) adds the concept to the repository of knownconcepts, where the concept was determined to be a validated concept instep 222.

In step 228, CAPM 104 (see FIG. 1) associates the concept to the knownpolicy sets, where the concept was added to the repository of knownconcepts in step 226. The association of the concept to the known policysets dictates what information and rules that CAPM 104 (see FIG. 1)applies to determine actions that system 100 takes to secure the data.Following step 228, the process of FIGS. 2A-2B loops back to step 208 inFIG. 2A.

In one embodiment, CAPM 104 (see FIG. 1) may switch the inspection ofthe API in steps 202, 204, 206, and 208 in FIG. 2A from a synchronousmode to an asynchronous mode. Inspection in asynchronous mode is usefulin circumstances in which CAPM 104 (see FIG. 1) determines that the riskof a security breach is minimal and trending data indicates no policyviolations. In asynchronous mode, CAPM 104 (see FIG. 1) does not blockor alter the request or the reply, but notifies required user groups ofa policy breach upon detection of the breach. Using asynchronous modeincreases throughput by avoiding the synchronous mode's processingburden of intervening at every request and reply and completing theanalysis by CAPM 104 (see FIG. 1) before completing the correspondingprocessing of the request or reply.

EXAMPLES

FIG. 3 is an example an API payload being converted to a concept map inthe process of FIG. 2, in accordance with embodiments of the presentinvention. After CAPM 104 (see FIG. 1) inspects an API payload 302 byperforming steps 202, 204, and 206 in FIG. 2A, CAPM 104 (see FIG. 1)converts API payload 302 into a concept map 304. For example, in step202 (see FIG. 2A), CAPM 104 (see FIG. 1) converts ord and items in APIpayload 302 to Order and Order_item, respectively, in concept map 304.In step 204 (see FIG. 2A), CAPM 104 (see FIG. 1) regroups attributenames ccard, cc_exp, and ccv in API payload 302 under the concept CreditCard in concept map 304. In step 206 (see FIG. 2A), CAPM 104 (seeFIG. 1) statistically matches the field value “1234 1234 1234 1234” ofccard in API payload 302 to a credit card format stored in a patternrepository, thereby confirming the concepts determined in steps 202 and204 (see FIG. 2A).

In step 208 (see FIG. 2A), by using a pre-existing graph of conceptsbased on industry lexicons, CAPM 104 (see FIG. 1) identifies a match toconcept map 304 and determines an inference score of the match toconcept map 304.

Computer System

FIG. 4 is a block diagram of a computer included in the system of FIG. 1and that implements the process of FIGS. 2A-2B, in accordance withembodiments of the present invention. Computer 102 is a computer systemthat generally includes a central processing unit (CPU) 402, a memory404, an input/output (I/O) interface 406, and a bus 408. Further,computer 102 is coupled to I/O devices 410 and a computer data storageunit 412. CPU 402 performs computation and control functions of computer102, including executing instructions included in program code 414 forcognitive API policy manager 104 (see FIG. 1) to perform a method ofsecuring data, where the instructions are executed by CPU 402 via memory404. CPU 402 may include a single processing unit, or be distributedacross one or more processing units in one or more locations (e.g., on aclient and server).

Memory 404 includes a known computer readable storage medium, which isdescribed below. In one embodiment, cache memory elements of memory 404provide temporary storage of at least some program code (e.g., programcode 414) in order to reduce the number of times code must be retrievedfrom bulk storage while instructions of the program code are executed.Moreover, similar to CPU 402, memory 404 may reside at a single physicallocation, including one or more types of data storage, or be distributedacross a plurality of physical systems in various forms. Further, memory404 can include data distributed across, for example, a local areanetwork (LAN) or a wide area network (WAN).

I/O interface 406 includes any system for exchanging information to orfrom an external source. I/O devices 410 include any known type ofexternal device, including a display, keyboard, etc. Bus 408 provides acommunication link between each of the components in computer 102, andmay include any type of transmission link, including electrical,optical, wireless, etc.

I/O interface 406 also allows computer 102 to store information (e.g.,data or program instructions such as program code 414) on and retrievethe information from computer data storage unit 412 or another computerdata storage unit (not shown). Computer data storage unit 412 includes aknown computer-readable storage medium, which is described below. In oneembodiment, computer data storage unit 412 is a non-volatile datastorage device, such as a magnetic disk drive (i.e., hard disk drive) oran optical disc drive (e.g., a CD-ROM drive which receives a CD-ROMdisk).

Memory 404 and/or storage unit 412 may store computer program code 414that includes instructions that are executed by CPU 402 via memory 404to secure data. Although FIG. 4 depicts memory 404 as including programcode, the present invention contemplates embodiments in which memory 404does not include all of code 414 simultaneously, but instead at one timeincludes only a portion of code 414.

Further, memory 404 may include an operating system (not shown) and mayinclude other systems not shown in FIG. 4.

Storage unit 412 and/or one or more other computer data storage units(not shown) that are coupled to computer 102 may store concepts, policysets, and patterns to which field values are matched.

As will be appreciated by one skilled in the art, in a first embodiment,the present invention may be a method; in a second embodiment, thepresent invention may be a system; and in a third embodiment, thepresent invention may be a computer program product.

Any of the components of an embodiment of the present invention can bedeployed, managed, serviced, etc. by a service provider that offers todeploy or integrate computing infrastructure with respect to securingdata. Thus, an embodiment of the present invention discloses a processfor supporting computer infrastructure, where the process includesproviding at least one support service for at least one of integrating,hosting, maintaining and deploying computer-readable code (e.g., programcode 414) in a computer system (e.g., computer 102) including one ormore processors (e.g., CPU 402), wherein the processor(s) carry outinstructions contained in the code causing the computer system to securedata. Another embodiment discloses a process for supporting computerinfrastructure, where the process includes integrating computer-readableprogram code into a computer system including a processor. The step ofintegrating includes storing the program code in a computer-readablestorage device of the computer system through use of the processor. Theprogram code, upon being executed by the processor, implements a methodof securing data.

While it is understood that program code 414 for securing data may bedeployed by manually loading directly in client, server and proxycomputers (not shown) via loading a computer-readable storage medium(e.g., computer data storage unit 412), program code 414 may also beautomatically or semi-automatically deployed into computer 102 bysending program code 414 to a central server or a group of centralservers. Program code 414 is then downloaded into client computers(e.g., computer 102) that will execute program code 414. Alternatively,program code 414 is sent directly to the client computer via e-mail.Program code 414 is then either detached to a directory on the clientcomputer or loaded into a directory on the client computer by a buttonon the e-mail that executes a program that detaches program code 414into a directory. Another alternative is to send program code 414directly to a directory on the client computer hard drive. In a case inwhich there are proxy servers, the process selects the proxy servercode, determines on which computers to place the proxy servers' code,transmits the proxy server code, and then installs the proxy server codeon the proxy computer. Program code 414 is transmitted to the proxyserver and then it is stored on the proxy server.

Another embodiment of the invention provides a method that performs theprocess steps on a subscription, advertising and/or fee basis. That is,a service provider, such as a Solution Integrator, can offer to create,maintain, support, etc. a process of securing data. In this case, theservice provider can create, maintain, support, etc. a computerinfrastructure that performs the process steps for one or morecustomers. In return, the service provider can receive payment from thecustomer(s) under a subscription and/or fee agreement, and/or theservice provider can receive payment from the sale of advertisingcontent to one or more third parties.

The present invention may be a system, a method, and/or a computerprogram product. The computer program product may include a computerreadable storage medium or media (i.e., memory 404 and computer datastorage unit 412) having computer readable program instructions 414thereon for causing a processor (e.g., CPU 402) to carry out aspects ofthe present invention.

The computer readable storage medium can be a tangible device that canretain and store instructions (e.g., program code 414) for use by aninstruction execution device (e.g., computer 102). The computer readablestorage medium may be, for example, but is not limited to, an electronicstorage device, a magnetic storage device, an optical storage device, anelectromagnetic storage device, a semiconductor storage device, or anysuitable combination of the foregoing. A non-exhaustive list of morespecific examples of the computer readable storage medium includes thefollowing: a portable computer diskette, a hard disk, a random accessmemory (RAM), a read-only memory (ROM), an erasable programmableread-only memory (EPROM or Flash memory), a static random access memory(SRAM), a portable compact disc read-only memory (CD-ROM), a digitalversatile disk (DVD), a memory stick, a floppy disk, a mechanicallyencoded device such as punch-cards or raised structures in a groovehaving instructions recorded thereon, and any suitable combination ofthe foregoing. A computer readable storage medium, as used herein, isnot to be construed as being transitory signals per se, such as radiowaves or other freely propagating electromagnetic waves, electromagneticwaves propagating through a waveguide or other transmission media (e.g.,light pulses passing through a fiber-optic cable), or electrical signalstransmitted through a wire.

Computer readable program instructions (e.g., program code 414)described herein can be downloaded to respective computing/processingdevices (e.g., computer 102) from a computer readable storage medium orto an external computer or external storage device (e.g., computer datastorage unit 412) via a network (not shown), for example, the Internet,a local area network, a wide area network and/or a wireless network. Thenetwork may comprise copper transmission cables, optical transmissionfibers, wireless transmission, routers, firewalls, switches, gatewaycomputers and/or edge servers. A network adapter card (not shown) ornetwork interface (not shown) in each computing/processing devicereceives computer readable program instructions from the network andforwards the computer readable program instructions for storage in acomputer readable storage medium within the respectivecomputing/processing device.

Computer readable program instructions (e.g., program code 414) forcarrying out operations of the present invention may be assemblerinstructions, instruction-set-architecture (ISA) instructions, machineinstructions, machine dependent instructions, microcode, firmwareinstructions, state-setting data, or either source code or object codewritten in any combination of one or more programming languages,including an object oriented programming language such as Smalltalk, C++or the like, and conventional procedural programming languages, such asthe “C” programming language or similar programming languages. Thecomputer readable program instructions may execute entirely on theuser's computer, partly on the user's computer, as a stand-alonesoftware package, partly on the user's computer and partly on a remotecomputer or entirely on the remote computer or server. In the latterscenario, the remote computer may be connected to the user's computerthrough any type of network, including a local area network (LAN) or awide area network (WAN), or the connection may be made to an externalcomputer (for example, through the Internet using an Internet ServiceProvider). In some embodiments, electronic circuitry including, forexample, programmable logic circuitry, field-programmable gate arrays(FPGA), or programmable logic arrays (PLA) may execute the computerreadable program instructions by utilizing state information of thecomputer readable program instructions to personalize the electroniccircuitry, in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations (e.g., FIGS. 2A-2B) and/or block diagrams (e.g.,FIG. 1 and FIG. 4) of methods, apparatus (systems), and computer programproducts according to embodiments of the invention. It will beunderstood that each block of the flowchart illustrations and/or blockdiagrams, and combinations of blocks in the flowchart illustrationsand/or block diagrams, can be implemented by computer readable programinstructions (e.g., program code 414).

These computer readable program instructions may be provided to aprocessor (e.g., CPU 402) of a general purpose computer, special purposecomputer, or other programmable data processing apparatus (e.g.,computer 102) to produce a machine, such that the instructions, whichexecute via the processor of the computer or other programmable dataprocessing apparatus, create means for implementing the functions/actsspecified in the flowchart and/or block diagram block or blocks. Thesecomputer readable program instructions may also be stored in a computerreadable storage medium (e.g., computer data storage unit 412) that candirect a computer, a programmable data processing apparatus, and/orother devices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions (e.g., program code 414) mayalso be loaded onto a computer (e.g. computer 102), other programmabledata processing apparatus, or other device to cause a series ofoperational steps to be performed on the computer, other programmableapparatus or other device to produce a computer implemented process,such that the instructions which execute on the computer, otherprogrammable apparatus, or other device implement the functions/actsspecified in the flowchart and/or block diagram block or blocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the block may occur out of theorder noted in the figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

While embodiments of the present invention have been described hereinfor purposes of illustration, many modifications and changes will becomeapparent to those skilled in the art. Accordingly, the appended claimsare intended to encompass all such modifications and changes as fallwithin the true spirit and scope of this invention.

What is claimed is:
 1. A method of securing data, the method comprisingthe steps of: a computer determining a context of names of attributes ofdata by matching the names of the attributes with respective classes ofobjects and terms in a domain, the data being included in a first callto an application programming interface (API) which is a first requestsent by a client computer system or a first reply sent by a servercomputer system; based on the context of the names of the attributes ofthe data, the computer making an initial determination that the names ofthe attributes of the data match a concept associated with the domain;the computer matching values of fields of the data to a pattern includedin a pattern repository that includes patterns that specify respectiveconcepts; based on the initial determination that the names of theattributes of the data match the concept associated with the domain andthe values of the fields of the data matching the pattern, the computeridentifying the concept associated with the domain as a concept of thedata and determining a first inference score indicating whether theidentified concept requires a validation by a human administrator; thecomputer determining that the first inference score does not exceed athreshold score and in response to the step of determining that thefirst inference score does not exceed the threshold score, the computerreceiving a determination by the human administrator that the identifiedconcept is validated; in response to the step of receiving thedetermination by the human administrator that the identified concept isvalidated, the computer increasing the first inference score to a secondinference score so that the second inference score exceeds the thresholdscore and indicates that the identified concept does not require thevalidation by the human administrator; the computer adding theidentified concept to a repository of known concepts; the computerassociating the identified concept to a set of known policies;subsequent to the step of associating the identified concept to the setof known policies: the computer determining a context of names of theattributes of the data included in a second call to the API which is asecond request sent by the client computer system or a second reply sentby the server computer system; the computer determining that the namesof the attributes of the data included in the second call match a secondconcept associated with the domain; the computer matching second valuesof fields of the data in the second call to the pattern; based on thedetermination that the names of the attributes of the data in the secondcall match the second concept associated with the domain, the computeridentifying the second concept associated with the domain as thepreviously identified concept associated with the first call anddetermining the second inference score rather than the first inferencescore as an inference score indicating whether the identified secondconcept requires the validation by the human administrator; the computerdetermining that the second inference score exceeds the threshold scoreand in response to the step of determining that the second inferencescore exceeds the threshold score, the computer determining whether theidentified second concept is associated with any set in sets of knownpolicies; the computer determining that the identified second concept isassociated with the set of known policies based on the second conceptbeing identified as the previously identified concept associated withthe first call; and based on the second inference score exceeding thethreshold score and the identified second concept being associated withthe set of known policies, the computer blocking the second request orthe second reply so that the second request or the second reply is notprocessed, the blocking of the second request or the second replysecuring the data in accordance with the set of known policies, theblocking being performed before a completion of a transaction thatincludes the second call, and the blocking being performed withoutrequiring the validation of the identified second concept by the humanadministrator, which increases an accuracy of automated intervention tosecure the data and decreases human intervention to secure the data. 2.The method of claim 1, wherein the step of identifying the conceptincludes determining a match between the identified concept and apredetermined graph of concepts based on lexicons.
 3. The method ofclaim 1, further comprising the steps of based on a third inferencescore for a third concept of the data not exceeding the threshold score,a determination by the human administrator that the third concept is notvalid, and a receipt of a new concept of the data, the computer addingthe new concept to a repository of known concepts and identifyinganother policy as being associated with the new concept.
 4. The methodof claim 3, further comprising the steps of: in response to the steps ofadding the new concept to the repository of known concepts andidentifying the other policy as being associated with the new concept,the computer determining a match between the new concept and apredetermined graph of concepts which are based on lexicons anddetermining another inference score indicating whether the new conceptrequires a validation; the computer determining that the other inferencescore exceeds the threshold score; and based on the other inferencescore exceeding the threshold score, the computer validating the otherpolicy associated with the new concept and performing an action tosecure the data based on the other policy.
 5. The method of claim 1,further comprising the step of the computer applying a cognitivecomputing technique on a payload of the second call to the API, whereinthe step of applying the cognitive computing technique includes thesteps of determining the context of the names of the attributes of thedata included in the second call and matching the second values of thefields of the data in the second call to the pattern included in thepattern repository, and wherein the step of identifying the secondconcept is based on the step of applying the cognitive computingtechnique.
 6. The method of claim 1, further comprising the step of thecomputer receiving the second request or the second reply from an APIproxy after the API proxy intercepts the second request being sent fromthe client computer system or the second reply being sent from theserver computer system.
 7. The method of claim 1, further comprising thestep of: providing at least one support service for at least one ofcreating, integrating, hosting, maintaining, and deploying computerreadable program code in the computer, the program code being executedby a processor of the computer to implement the steps of determining thecontext of the names of the attributes of the data, making the initialdetermination that the names of the attributes of the data match theconcept associated with the domain, matching the values of the fields ofthe data to the pattern included in the pattern repository, identifyingthe concept associated with the domain as the concept of the data,determining the first inference score, determining that the firstinference score does not exceed the threshold score, receiving thedetermination by the human administrator that the identified concept isvalidated, increasing the first inference score to the second inferencescore, adding the identified concept to the repository of knownconcepts, associating the identified concept to the set of knownpolicies, determining the context of the names of the attributes of thedata included in the second call, determining that the names of theattributes of the data in the second call match the second conceptassociated with the domain, matching the second values of fields of thedata in the second call to the pattern, identifying the second conceptassociated with the domain as the previously identified concept,determining the second inference score as the inference score indicatingwhether the identified second concept requires the validation by thehuman administrator, determining that the second inference score exceedsthe threshold score, determining whether the identified second conceptis associated with any set in the sets of known policies, determiningthat the identified second concept is associated with the set of knownpolicies, and blocking the second request or the second reply.
 8. Acomputer program product for securing data, the computer program productcomprising a computer readable storage medium having programinstructions stored thereon, the program instructions are executed by acentral processing unit (CPU) of a computer system to cause the computersystem to: determine, by the CPU, a context of names of attributes ofdata by matching the names of the attributes with respective classes ofobjects and terms in a domain, the data being included in a first callto an application programming interface (API) which is a first requestsent by a client computer system or a first reply sent by a servercomputer system; make, by the CPU and based on the context of the namesof the attributes of the data, an initial determination that the namesof the attributes of the data match a concept associated with thedomain; match, by the CPU, values of fields of the data to a patternincluded in a pattern repository that includes patterns that specifyrespective concepts; identify, by the CPU and based on the initialdetermination that the names of the attributes of the data match theconcept associated with the domain and the values of the fields of thedata matching the pattern, the concept associated with the domain as aconcept of the data and determine, by the CPU and based on the initialdetermination that the names of the attributes of the data match theconcept associated with the domain and the values of the fields of thedata matching the pattern, a first inference score indicating whetherthe identified concept requires a validation by a human administrator;determine, by the CPU, that the first inference score does not exceed athreshold score and in response to determining that the first inferencescore does not exceed the threshold score, receive, by the CPU, adetermination by the human administrator that the identified concept isvalidated; increase, by the CPU and in response to receiving thedetermination by the human administrator that the identified concept isvalidated, the first inference score to a second inference score so thatthe second inference score exceeds the threshold score and indicatesthat the identified concept does not require the validation by the humanadministrator; add, by the CPU, the identified concept to a repositoryof known concepts; associate, by the CPU, the identified concept to aset of known policies; subsequent to associating the identified conceptto the set of known policies: determine, by the CPU, a context of namesof the attributes of the data included in a second call to the API whichis a second request sent by the client computer system or a second replysent by the server computer system; determine, by the CPU, that thenames of the attributes of the data included in the second call match asecond concept associated with the domain; match, by the CPU, secondvalues of fields of the data in the second call to the pattern;identify, by the CPU and based on the determination that the names ofthe attributes of the data in the second call match the second conceptassociated with the domain, the second concept associated with thedomain as the previously identified concept associated with the firstcall and determine, by the CPU and based on the confirmation of thedetermination that the data structure and the names of the attributes ofthe data in the second call match the second concept associated with thedomain, the second inference score rather than the first inference scoreas an inference score indicating whether the identified second conceptrequires the validation by the human administrator; determine, by theCPU, that the second inference score exceeds the threshold score and inresponse to the step of determining that the second inference scoreexceeds the threshold score, determine, by the CPU, whether theidentified second concept is associated with any set in sets of knownpolicies; determine, by the CPU, that the identified second concept isassociated with the set of known policies based on the second conceptbeing identified as the previously identified concept associated withthe first call; and block, by the CPU and based on the second inferencescore exceeding the threshold score and the identified second conceptbeing associated with the set of known policies, the second request orthe second reply so that the second request or the second reply is notprocessed, the blocking of the second request or the second replysecuring the data in accordance with the set of known policies, theblocking being performed before a completion of a transaction thatincludes the second call, and the blocking being performed withoutrequiring the validation of the identified second concept by the humanadministrator, which increases an accuracy of automated intervention tosecure the data and decreases human intervention to secure the data. 9.The computer program product of claim 8, wherein the programinstructions executed by the CPU to identify, by the CPU, the conceptinclude program instructions that are executed by the CPU to determine,by the CPU, a match between the identified concept and a predeterminedgraph of concepts based on lexicons.
 10. The computer program product ofclaim 8, further comprising the computer readable storage medium havingfurther program instructions stored thereon, the further programinstructions are executed by the CPU to cause the CPU to add, based on athird inference score for a third concept of the data not exceeding thethreshold score, a determination by the human administrator that thethird concept is not valid, and a receipt of a new concept of the data,the new concept to a repository of known concepts and identify anotherpolicy as being associated with the new concept.
 11. The computerprogram product of claim 10, further comprising the computer readablestorage medium having further program instructions stored thereon, thefurther program instructions are executed by the CPU to cause the CPUto: determine, by the CPU, and in response to the steps of adding thenew concept to the repository of known concepts and identifying theother policy as being associated with the new concept, a match betweenthe new concept and a predetermined graph of concepts which are based onlexicons and determine, by the CPU, another inference score indicatingwhether the new concept requires a validation; determine, by the CPU,that the other inference score exceeds the threshold score; andvalidate, by the CPU, and based on the other inference score exceedingthe threshold score, the other policy associated with the new conceptand perform, by the CPU, an action to secure the data based on the otherpolicy.
 12. The computer program product of claim 8, further comprisingthe computer readable storage medium having further program instructionsstored thereon, the further program instructions are executed by the CPUto cause the CPU to apply, by the CPU, a cognitive computing techniqueon a payload of the second call to the API, wherein the step of applyingthe cognitive computing technique includes the steps of determining thecontext of the names of the attributes of the data included in thesecond call and matching the second values of the fields of the data inthe second call to the pattern included in the pattern repository, andwherein the step of identifying the second concept is based on the stepof applying the cognitive computing technique.
 13. The computer programproduct of claim 8, further comprising the computer readable storagemedium having further program instructions stored thereon, the furtherprogram instructions are executed by the CPU to cause the CPU to receivethe second request or the second reply from an API proxy after the APIproxy intercepts the second request being sent from the client computersystem or the second reply being sent from the server computer system.14. A computer system comprising: a central processing unit (CPU); amemory coupled to the CPU; and a computer readable storage mediumcoupled to the CPU, the computer readable storage medium containinginstructions that are executed by the CPU via the memory to implement amethod of securing data, the method comprising the steps of: thecomputer system determining a context of names of attributes of data bymatching the names of the attributes with respective classes of objectsand terms in a domain, the data being included in a first call to anapplication programming interface (API) which is a first request sent bya client computer system or a first reply sent by a server computersystem; based on the context of the names of the attributes of the data,the computer system making an initial determination that the names ofthe attributes of the data match a concept associated with the domain;the computer system matching values of fields of the data to a patternincluded in a pattern repository that includes patterns that specifyrespective concepts; based on the initial determination that the namesof the attributes of the data match the concept associated with thedomain and the values of the fields of the data matching the pattern,the computer system identifying the concept associated with the domainas a concept of the data and determining a first inference scoreindicating whether the identified concept requires a validation by ahuman administrator; the computer system determining that the firstinference score does not exceed a threshold score and in response to thestep of determining that the first inference score does not exceed thethreshold score, the computer system receiving a determination by thehuman administrator that the identified concept is validated; inresponse to the step of receiving the determination by the humanadministrator that the identified concept is validated, the computersystem increasing the first inference score to a second inference scoreso that the second inference score exceeds the threshold score andindicates that the identified concept does not require the validation bythe human administrator; the computer system adding the identifiedconcept to a repository of known concepts; the computer systemassociating the identified concept to a set of known policies;subsequent to the step of associating the identified concept to the setof known policies: the computer system determining a context of names ofthe attributes of the data included in a second call to the API which isa second request sent by the client computer system or a second replysent by the server computer system; the computer system determining thatthe names of the attributes of the data included in the second callmatch a second concept associated with the domain; the computer systemmatching second values of fields of the data in the second call to thepattern; based on the determination that the names of the attributes ofthe data in the second call match the second concept associated with thedomain, the computer system identifying the second concept associatedwith the domain as the previously identified concept associated with thefirst call and determining the second inference score rather than thefirst inference score as an inference score indicating whether theidentified second concept requires the validation by the humanadministrator; the computer system determining that the second inferencescore exceeds the threshold score and in response to the step ofdetermining that the second inference score exceeds the threshold score,the computer system determining whether the identified second concept isassociated with any set in sets of known policies; the computer systemdetermining that the identified second concept is associated with theset of known policies based on the second concept being identified asthe previously identified concept associated with the first call; andbased on the second inference score exceeding the threshold score andthe identified second concept being associated with the set of knownpolicies, the computer system blocking the second request or the secondreply so that the second request or the second reply is not processed,the blocking of the second request or the second reply securing the datain accordance with the set of known policies, the blocking beingperformed before a completion of a transaction that includes the secondcall, and the blocking being performed without requiring the validationof the identified second concept by the human administrator, whichincreases an accuracy of automated intervention to secure the data anddecreases human intervention to secure the data.
 15. The computer systemof claim 14, wherein the step of identifying the concept includesdetermining a match between the identified concept and a predeterminedgraph of concepts based on lexicons.
 16. The computer system of claim14, wherein the method further comprises the steps of based on a thirdinference score for a third concept of the data not exceeding thethreshold score, a determination by the human administrator that thethird concept is not valid, and a receipt of a new concept of the data,the computer system adding the new concept to a repository of knownconcepts and identifying another policy as being associated with the newconcept.
 17. The computer system of claim 16, wherein the method furthercomprises the steps of: in response to the steps of adding the newconcept to the repository of known concepts and identifying the otherpolicy as being associated with the new concept, the computer systemdetermining a match between the new concept and a predetermined graph ofconcepts which are based on lexicons and determining another inferencescore indicating whether the new concept requires a validation; thecomputer system determining that the second inference score exceeds thethreshold score; and based on the other inference score exceeding thethreshold score, the computer system validating the other policyassociated with the new concept and performing an action to secure thedata based on the other policy.
 18. The computer system of claim 14,wherein the method further comprises the step of the computer systemapplying a cognitive computing technique on a payload of the second callto the API, wherein the step of applying the cognitive computingtechnique includes the steps of determining the context of the names ofthe attributes of the data included in the second call and matching thesecond values of the fields of the data in the second call to thepattern included in the pattern repository, and wherein the step ofidentifying the second concept is based on the step of applying thecognitive computing technique.
 19. The computer system of claim 14,wherein the method further comprises the step of the computer systemreceiving the second request or the second reply from an API proxy afterthe API proxy intercepts the second request being sent from the clientcomputer system or the second reply being sent from the server computersystem.